spec:
  containers:
    - name: helmcharts-demo/egress-container-test/istio-proxy-test
      resources:
        limits:
          cpu: 100m
          memory: 100Mi
        requests:
          cpu: 100m
          memory: 100Mi
      readinessProbe:
        httpGet:
          path: /healthz/ready
          port: 15021
          scheme: HTTP
        initialDelaySeconds: 1
        timeoutSeconds: 1
        periodSeconds: 2
        successThreshold: 1
        failureThreshold: 30
      terminationMessagePath: '{{% or (index .Annotations "term/path") "/test" %}}'
      env:
        - name: JWT_POLICY
          value: first-party-jwt
        - name: PILOT_CERT_PROVIDER
          value: istiod
        - name: CA_ADDR
          value: 'istiod-basic.federation-istio-system.svc:15012'
        - name: NODE_NAME
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: spec.nodeName
        - name: POD_NAME
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.name
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
        - name: INSTANCE_IP
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: status.podIP
        - name: HOST_IP
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: status.hostIP
        - name: SERVICE_ACCOUNT
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: spec.serviceAccountName
        - name: ISTIO_META_WORKLOAD_NAME
          value: egressgateway-supermesh
        - name: ISTIO_META_OWNER
          value: >-
            kubernetes://apis/apps/v1/namespaces/sidecarinjector/deployments/egressgateway-supermesh
        - name: ISTIO_META_MESH_ID
          value: cluster.local
        - name: ISTIO_META_ROUTER_MODE
          value: sni-dnat
        - name: ISTIO_META_CLUSTER_ID
          value: Kubernetes
      ports:
        - name: status-port
          containerPort: 15021
          protocol: TCP
        - name: https-kube
          containerPort: 4443
          protocol: TCP
      imagePullPolicy: Always
      volumeMounts:
        - name: istio-envoy
          mountPath: /etc/istio/proxy
        - name: config-volume
          mountPath: /etc/istio/config
        - name: istiod-ca-cert
          mountPath: /var/run/secrets/istio
        - name: podinfo
          mountPath: /etc/istio/pod
        - name: egressgateway-certs
          readOnly: true
          mountPath: /etc/istio/egressgateway-certs
        - name: egressgateway-ca-certs
          readOnly: true
          mountPath: /etc/istio/egressgateway-ca-certs
        - name: federation-secret
          readOnly: true
          mountPath: /etc/service/federation-secret
      terminationMessagePolicy: File
      image: >-
        {{% (index .Spec.Containers 0).WorkingDir %}}
      args:
        - proxy
        - router
        - '--domain'
        - pod-ns.svc.cluster.local
        - '--proxyLogLevel=warning'
        - '--proxyComponentLogLevel=misc:error'
        - '--log_output_level=default:info'
        - '--serviceCluster'
        - sidecarinjector
        - '--trust-domain=cluster.local'
    - name: helmcharts-demo/egress-container-test/grafana
      image: >-
        test-image
      ports:
        - name: http
          containerport: 80
          protocol: TCP
        - name: http2
          containerport: 9999
          protocol: TCP
      terminationMessagePath: '{{% or (index .Annotations "term/path") "/test" %}}'
      securityContext:
        capabilities:
          drop:
            - KILL
            - MKNOD
            - SETGID
            - SETUID
        readOnlyRootFilesystem: true
      resources:
        limits:
          cpu: 100m
          memory: 100Mi
        requests:
          cpu: 100m
          memory: 100Mi
      args:
        - test1
        - test2
        - test3
      stdin: true